{"record":{"id":"e55a7559f631ebcb","repo":"justauth/JustAuth","slug":"object-getstring-error-description-e55a75","errorCode":null,"errorMessage":"object.getString(\"error_description\")","messagePattern":"object\\.getString\\(\"error_description\"\\)","errorType":"exception","errorClass":"AuthException","httpStatus":null,"severity":"error","filePath":"src/main/java/me/zhyd/oauth/request/AuthOktaRequest.java","lineNumber":117,"sourceCode":"            .build();\n    }\n\n    @Override\n    public AuthResponse revoke(AuthToken authToken) {\n        Map<String, String> params = new HashMap<>(4);\n        params.put(\"token\", authToken.getAccessToken());\n        params.put(\"token_type_hint\", \"access_token\");\n\n        HttpHeader header = new HttpHeader()\n            .add(\"Authorization\", \"Basic \" + Base64Utils.encode(config.getClientId().concat(\":\").concat(config.getClientSecret())));\n        new HttpUtils(config.getHttpConfig()).post(revokeUrl(authToken), params, header, false);\n        AuthResponseStatus status = AuthResponseStatus.SUCCESS;\n        return AuthResponse.builder().code(status.getCode()).msg(status.getMsg()).build();\n    }\n\n    private void checkResponse(JSONObject object) {\n        if (object.containsKey(\"error\")) {\n            throw new AuthException(object.getString(\"error_description\"));\n        }\n    }\n\n    @Override\n    public String authorize(String state) {\n        return UrlBuilder.fromBaseUrl(String.format(source.authorize(), config.getDomainPrefix(), config.getAuthServerId()))\n            .queryParam(\"response_type\", \"code\")\n            .queryParam(\"prompt\", \"consent\")\n            .queryParam(\"client_id\", config.getClientId())\n            .queryParam(\"redirect_uri\", config.getRedirectUri())\n            .queryParam(\"scope\", this.getScopes(\" \", true, AuthScopeUtils.getDefaultScopes(AuthOktaScope.values())))\n            .queryParam(\"state\", getRealState(state))\n            .build();\n    }\n\n    @Override\n    public String accessTokenUrl(String code) {\n        return UrlBuilder.fromBaseUrl(String.format(source.accessToken(), config.getDomainPrefix(), config.getAuthServerId()))","sourceCodeStart":99,"sourceCodeEnd":135,"githubUrl":"https://github.com/justauth/JustAuth/blob/694bbf1b010d93404e3bfb4824d90e9ddfaebebb/src/main/java/me/zhyd/oauth/request/AuthOktaRequest.java#L99-L135","documentation":"AuthOktaRequest.checkResponse throws AuthException with 'error_description' when an Okta API response contains an 'error' key. Okta returns standard OAuth2 error JSON for token, refresh, and userinfo calls against {domainPrefix}.okta.com/oauth2/{authServerId}.","triggerScenarios":"Token exchange or userinfo when Okta returns invalid_grant (code expired/consumed), invalid_client (bad client secret), or when the Authorization Server ID is wrong so the request hits a non-existent endpoint returning an error body.","commonSituations":"Wrong domainPrefix or authServerId in AuthConfig (Okta org vs custom authorization server mix-up), missing 'okta.users.read.self' style scopes, or the app's grant type not enabled for authorization_code.","solutions":["Verify domainPrefix and authServerId: the authorize URL must be https://{prefix}.okta.com/oauth2/{authServerId}/v1/...","Enable 'Authorization Code' grant and assign the app to the authorization server's policy","Read error_description for the precise OAuth2 error and act accordingly","Ensure the authorization code is redeemed exactly once and promptly"],"exampleFix":"null","handlingStrategy":"try-catch","validationCode":"null","typeGuard":"null","tryCatchPattern":"try {\n    oktaRequest.getAuthResponse(callback);\n} catch (AuthException e) {\n    log.warn(\"Okta error: {}\", e.getMessage());\n    if (e.getMessage() != null && e.getMessage().contains(\"invalid_client\")) {\n        // fix client secret\n    }\n}","preventionTips":["Validate domainPrefix/authServerId by curl-ing {prefix}.okta.com/oauth2/{serverId}/.well-known/oauth-authorization-server first","Enable authorization_code grant and correct redirect URI on the Okta app","Exchange codes once and immediately; Okta codes are single-use"],"tags":["oauth","okta","auth-server","auth-exception"],"backgroundTag":null,"analyzedSha":"694bbf1b010d93404e3bfb4824d90e9ddfaebebb","analyzedAt":"2026-08-14T15:16:59.945Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}